Building the rightgovernance modelfor AI/ML
How banks can identify and manage risks
to build trust and accelerate adoptionExecutive summary: preparing for the AI/ML tipping point

Executive summary:
preparing for the
AI/ML tipping point
The financial services industry is investing significantly
in artificial intelligence (AI) and machine learning(ML) applications to monetize data assets, improvecustomer experience, customize product and service
offerings, drive business growth and enhance operational
efficiencies.
As these applications become key enablers of business strategies and more deeply
embedded in processes, financial services organizations need to establish that theircontrol environments keep pace with business capabilities and are commensurate with
the inherent risks of AI/ML applications.
This article focuses on a four-step strategy to accelerate the adoption of AI/ML in
the banking industry in a manner that creates stakeholder trust and accountability
through proper governance and risk management. The strategy takes into
consideration the regulatory environment, underlying business strategy and theunique risks posed by AI/ML applications. The four-step strategy includes the following:

1
2
3
4

Develop an enterprise-wide AI/ML definition to identify AI/ML risks
Enhance existing risk management and control frameworks to address
AI/ML-specific risks
Implement an operating model for responsible AI/ML adoption
Invest in capabilities that support AI/ML adoption and risk management

Though directed mainly at banks, all types of financial services organizations canconsider the insights and recommendations presented here.

1| Building the right governance model for AI/ML

AI/ML definitions, capabilities and risks

AI/ML definitions,capabilities and risks
Given that there are no industry-wide definitions of
AI/ML, for the purposes of this article, we arereferencing those included in a 2017 paper publishedby the Financial Stability Board (FSB).1 The FSB
refers to AI as a theory and development of computer
systems able to perform tasks that traditionally haverequired human intelligence. Machine learning is oneof the ways to achieve AI, and can be described as amethod of designing a sequence of actions to solvea problem, known as algorithms, which optimize
automatically through experience and with limited orno human intervention.

One of the key challenges with advanced AI/ML
techniques is the opacity of the output. Unlike
traditional techniques, where underlying inputs,
assumptions, specifications and transformation logic(e.g., input-output relationship) are transparent,
advanced AI/ML algorithms are complex and not easily
understood. Given the nature of transformations, thealgorithm output is hard to explain and interpret. Some
AI/ML algorithms are also available via open source
and third parties, where the users may not be exposedto the underlying algorithms, resulting in lack oftransparency.

Machine learning algorithms include several categories
based on the level of human intervention for datalabeling. These categories include supervised learning,
unsupervised learning, reinforcement learning anddeep learning.

Without access to large and rich data sets fordevelopment and ongoing training, the effectivenessof AI/ML models may be limited. Data availability,
suitability and quality are significant challenges andexpose AI/ML algorithms to significant data risks (e.g.,bias in data sets, training data limitations, privacy)
during data sourcing, application development
and ongoing use. These model and data risks also
exacerbate compliance, conduct and legal risks
when AI/ML algorithms are used for customer-facing
applications such as credit decisioning and marketing.

A wide range of AI/ML techniques is available for use.
This article focuses on the advanced AI/ML techniques(e.g., neural networks), excluding the predefined rulesbased automation and traditional statistical modelingtechniques (e.g., linear regression). One of the uniquefeatures of advanced AI/ML techniques is that they use
large amounts of high-dimensional data to derive
nonlinear relationships for classification and/or
prediction. The ability to mine big data using
digitization, transcription and natural language
processing (NLP) is enabling new products and use
cases. For example, optical character recognition and
NLP are being used extensively for extracting value
from complex documents, such as legal contracts, andfor voice transcription, while NLP techniques are being
used for chatbots and trade surveillance.

1

As AI/ML applications automate human decisions andmanual activities, the use of AI/ML should reduce
certain risks (e.g., manual errors); however, these
operational risks from manual processes will evolve totechnology risks like information security and cybervulnerabilities over the AI/ML algorithms and data
(see figure 1).

”Artificial intelligence and machine learning in financial services: Market
developments and financial stability implications,” Financial Stability Board website,
https://www.fsb.org/wp-content/uploads/P011117.pdf, 1 November 2017.

Building the right governance model for AI/ML |2

AI/ML definitions, capabilities and risks

Figure 1: AI/ML risks

Key risks

Customers

Information sharing trade-off:Highercustomizationvs.

privacy anddiscrimination concerns

Big
data

Model

Use

► Velocity► High-dimensional data

► Customization► Variety► Explainability/► Digital► Online training, changes,► Data collection

transparency► Volume► Privacy

Business drivers

Control environment► Bias► Third party/open source

Infrastructure► Cloud► Latency► Open source► API► Compute► Third party

Three lines ofdefense operating
model

Talentandtraining► Use-case prioritization► Data science► Agile work methods► Data engineering► New roles► Modeling► Integrated and► Functionalcross–functional

As the scale of AI/ML applications increases over time,
investments in the supporting ecosystem (data, models,
infrastructure) will introduce operational risks due to theinterconnected and dynamic nature of the ecosystem.

3

Data risk
Third-party risk
Technology risk
► Cyber ► Information security► SDLC ► Business continuity

planning/resilience

Businesstransformation

Competition

ongoing monitoring► Third party

Innovation and new
product/businessProﬁtability/efﬁciency

interaction

Model risk

| Building the right governance model for AI/ML

Conduct/compliance/
legal risk
Business process risk

Regulators

The lines between various risk stripes will blur due to thevelocity and scale of risk impacts. Therefore, understanding
and managing the aggregate risks, along with theirinterconnectedness and dynamic nature, is a significant
challenge in scaling AI/ML applications.

Current state of AI/ML adoption in financial services

Current state of AI/ML
adoption in financial services
The banking industry has made significant investmentsin the last 10 years to meet the heightened regulatory
requirements that developed after the financial crisis.
Banks are now focusing aggressively on their growth
agenda, which includes business transformation, facing
competitive threats, enhancing customer experienceand identifying operational efficiencies. There is a clear
recognition that emerging technologies such as AI/
ML will transform business models and will be a key
competitive differentiator. Banks are not only increasing
technology investments, but also considering strategic
mergers, acquisitions and partnerships to scale theseinvestments.

• Cyber risk management• Customer behavior and sentiment analysis formarketing purposes• Credit decisioning based on unstructured data
• Dynamic pricing• Product and service recommendations• Forecasting
The banking industry is at an inflection point in thedevelopment of AI/ML applications. The potential
benefits are driving investments in the ecosystem ofdata, infrastructure and talent, and the number ofapplications is expected to expand exponentially acrossthe enterprise. With the rapid innovation and investment
in supporting capabilities and the large pipeline of
proofs of concept (POCs), we estimate some largebanks will have more than 300 AI/ML applications in
production in the next two years. These applications will
be increasingly embedded within the client experienceand user interfaces, products, operational processes
and applications (see figure 2).

There are many AI/ML use cases currently in
production, with most cases involving low-risk
applications that automate operational processes andaugment human decision-making. Common applications
implemented to date include:• Fraud monitoring and suspicious activity surveillance• Chatbots for external and internal customer service• Analysis of documents and other unstructured datausing NLP

Figure 2: AI/ML and robotic process automation in the mortgage lending process

Origination

Processing

Loanapplication

ClientProperty inspection/
appraisal

Underwriting

Client credit
assessment

Digital/RPA

Preapproval
Al/RPA

ChatbotAI

Find
property

Closing

Final loan approval
Al/RPA

Documentation
for underwriting

Fraud/KYC
RPA

Closing disclosures
Al/RPA

Review property
appraisal

Final closing

Al/RPA

Building the right governance model for AI/ML |4

Current state of AI/ML adoption in financial services

As the number of and reliance on AI/ML applications
increase across end-to-end business processes, theaggregate risk can become significant due to theopacity of certain AI/ML applications, even if theapplications individually present low risks. Any misstep
in the adoption of AI/ML could cause long-term value
destruction given the potential reputational, regulatory
and financial impacts, especially for retail consumerfocused organizations. The last financial crisis also
highlighted risks from overreliance on models andintroduction of complex products without complete
understanding of the inherent limitations.
Introducing new products and applications
incorporating AI/ML increases the tension between
innovation and risk management. This tension
should resolve over time as AI/ML applications
mature and the industry continues to progress in
mitigating limitations like output opacity, increasing
the availability of longer-term performance data, andenhancing governance and control frameworks moregenerally.

5| Building the right governance model for AI/ML

At a recent industry
conference, EY and
MIT Technology
Review Insights
polled 122 businessleaders regarding thecurrent state of AI/ML
adoption. Nearly halfof the respondents
cited lack of confidence
in the quality andtrustworthiness ofdata as a challenge
for enterprise-wide
AI programs.

Asking the right questions: aligning business strategy and AI/ML risk appetite

Asking the rightquestions:aligning businessstrategy and AI/ML
risk appetite
Banks that invest in the appropriate governance andcontrols can hold AI/ML applications accountable fordesired outcomes and will foster trust with key internaland external stakeholders. This, in turn, will facilitate
the creation of a more sustainable model for using
AI/ML and help drive business transformation.
Trusted AI/ML ecosystems will become a competitive
advantage for banking organizations by attracting andretaining customers and talent, promoting innovationand improving stakeholder trust in the products andservices.
To accelerate and scale the use of AI/ML applications,banks must clearly align business strategy and risk
appetite, which should then translate into an AI/ML
adoption strategy. Based on these three inputs,
banks should calibrate investments in governance andcontrols.

To accelerate and scale the useof AI/ML applications, banks
must clearly align businessstrategy and risk appetite, whichshould then translate into an
AI/ML adoption strategy.
Building the right governance model for AI/ML |6

Asking the right questions: aligning business strategy and AI/ML risk appetite

It is critical that the board and senior management understand the unique AI/ML risks, articulate the risk
appetite, and embed governance and controls considerations in the AI/ML adoption strategy to answer
questions related to AI/ML opportunities, capabilities and risk management:

Opportunities
1. How is the AI/ML landscape evolving for banks, and where do we want to be in that landscape?
2. How will AI/ML accelerate our business strategy and become a competitive advantage?
3. Where are we currently using AI/ML, and to what extent are these applications scalable?

Capabilities
4. How do we accelerate prudent adoption of AI/ML to drive business transformation and innovation?
5. Do we have an enterprise-level AI/ML adoption strategy, including priorities, capabilities and investments?

Risk management
6. How are we taking into consideration the risks and regulatory expectations associated with AI/ML?
7. How do existing risk and control frameworks need to be enhanced to address these risks?
8. How do we build stakeholder trust and confidence in AI/ML?
9. How do we best communicate our AI/ML adoption strategy to key stakeholders?

The right governance and controls can help banks design applications with the right business purpose that allow
for continuous fine-tuning of control environments based on vigilant monitoring and supervision. Banks should
enhance existing governance and control frameworks and operating models to address AI/ML risks instead ofcreating entirely new policies, frameworks and operational requirements.

7| Building the right governance model for AI/ML

What regulators expect

What regulators
expectIn financial services, dialogue between global regulators andindustry participants on the benefits and risks associated with
AI/ML applications has expanded recently.2 There has also been
discussion surrounding the supervisory implications of banks’
growing reliance on AI/ML.3 Some regulators have articulated
key principles on the appropriate use of AI/ML. For example,
the Monetary Authority of Singapore has issued principles topromote fairness, ethics, accountability and transparency.4
In Hong Kong, the Hong Kong Monetary Authority (HKMA)
has issued guidance to the banking industry on the use of AI
applications.5
Regulations related to data privacy (such as the General Data
Protection Regulation) and open banking will further shape the
AI/ML landscape by establishing data privacy and portability
standards affecting global banking institutions. Similarly, theHKMA issued guiding principles on consumer protection aspects
in respect of big data analytics and artificial intelligence.6
In the US, the Federal Reserve Board has reinforced therelevance and applicability of existing regulatory standards andguidance (e.g., SR 11-7 Guidance on Model Risk Management,
SR 13-19 Guidance on Vendor Risk Management) rather than
indicating a need for new standards or requirements.7
There is an absence of specific guidance or standards related to
AI/ML techniques as regulators seek to avoid stifling innovation,
while at the same time promoting safety and soundness,
protecting consumers and enhancing financial stability. For
example, US regulators have acknowledged the benefits that
AI/ML can provide, such as compliance with the Bank Secrecy
Act and anti-money laundering regulations.8
2”FSB considers financial stability implications of artificial intelligence and machine learning,”
Financial Stability Board website, http://www.fsb.org/2017/11/fsb-considers-financial-stabilityimplications-of-artificial-intelligence-and-machine-learning/, 1 November 2017.

3“Big Data and Artificial Intelligence: BaFin publishes results of a study,” Federal Financial Supervisory Authority website, https://www.bafin.de/SharedDocs/Veroeffentlichungen/EN/Fachartikel/2018/fa_bj_1806_BDAI_Studie_en.html, 16 July 2018.

4“MAS introduces new FEAT Principles to promote responsible use of AI and data analytics,”
Monetary Authority of Singapore website, https://www.mas.gov.sg/news/media-releases/2018/
mas-introduces-new-feat-principles-to-promote-responsible-use-of-ai-and-data-analytics, 12November 2018.

5“High-level Principles on Artificial Intelligence,” Hong Kong Monetary Authority website, https://www.hkma.gov.hk/media/eng/doc/key-information/guidelines-and-circular/2019/20191101e1.
pdf, 1 November 2019.

6“Consumer Protection in respect of Big Data Analytics and Artificial Intelligence by AuthorizedInstitutions,” Hong Kong Monetary Authority website, https://www.hkma.gov.hk/media/eng/doc/
key-information/guidelines-and-circular/2019/20191105e1.pdf, 5 November 2019.

7

Lael Brainard, “What Are We Learning about Artificial Intelligence in Financial Services?,” Boardof Governors of the Federal Reserve System website, https://www.federalreserve.gov/newsevents/speech/brainard20181113a.htm, 13 November 2018.

8“SR 18-10: Joint Statement on Innovative Efforts to Combat Money Laundering and Terrorist
Financing,” Board of Governors of the Federal Reserve System website, https://www.federalreserve.gov/supervisionreg/srletters/sr1810.htm, 3 December 2018.

The relevance of existing guidance highlights theimportance of demonstrating that AI/ML application
development, implementation, use and validation
conform to SR 11-7 and 13-19 (where applicable). Coreregulatory principles would suggest that broader risks
posed by AI/ML (such as privacy and cybersecurity) thatare not explicitly captured in model risk management
should be considered within other risk management
frameworks and that banks should establish newcontrols to address AI/ML-specific risks and limitations.
As the use of AI/ML becomes more prevalent, we
anticipate that regulators will turn their focus more
explicitly toward the interconnected and dynamic natureof the risks underlying these applications and theoperational resiliency of the overall AI/ML ecosystem.
Further, we expect regulators will use the examination
process to identify supervisory concerns as the basis
for more coherent and integrated guidelines across thetotality of risks associated with AI/ML.

“

There are plenty of examples ofAI approaches not functioning
as expected — a reminderthat things can go wrong. It is
important for firms to recognize
the possible pitfalls and employ
sound controls now to preventand mitigate possible future
problems.

Lael Brainard
FRB Governor, November 2018

Building the right governance model for AI/ML |8

The way forward: four steps to establish governance and risk frameworks that streamline and scale AI/ML adoption

The way forward:
four steps to establish
governance andrisk frameworks thatstreamline and scale
AI/ML adoption
In moving forward, banks should consider thefollowing four steps:

1
2

Develop an enterprise-wide AI/ML definition to
identify AI/ML risks
Enhance existing risk management and control
frameworks to address AI/ML-specific risks• Enhance individual risk management andcontrol frameworks• Establish cross-functional governance3
4
9• Develop risk-based application of controls to
promote innovation and speed to market
Implement an operating model for responsible
AI/ML adoption
Invest in capabilities that support AI/ML adoption
and risk management| Building the right governance model for AI/ML

The way forward: four steps to establish governance and risk frameworks that streamline and scale AI/ML adoption

1

Develop an enterprise-wide AI/ML
definition to identify AI/ML risks

Application of risk and control frameworks generally
starts with the definition and identification process.
Some AI/ML applications (e.g., chatbots) do not
fit existing definitions cleanly, which may create
gaps in risk identification and management. AI/ML
applications might be embedded in spreadsheets,
technology systems and analytics platforms or ownedby third parties, making them difficult to identify andinventory.
Establishing an enterprise-wide definition for AI/ML
is necessary to facilitate a consistent understanding,communicate and prioritize AI/ML use cases, anddesign risk management frameworks.
To identify AI/ML applications, banks may consider
leveraging the existing model inventory management
process with specific considerations for certain AI/ML
techniques, key characteristics of the ML algorithms(e.g., dynamic calibration) and capabilities. Due to theevolving nature of and advancements in AI/ML, banks
should consider establishing a process to monitor
and update the scope of the model identification andinventory management process on a regular basis.
Given the range of AI/ML techniques, platforms,
vendors and capabilities, it is important to adopt
consistent guidance across the enterprise of what
constitutes an AI/ML application. The guidanceshould be embedded within innovation programs,
new product/business approval processes, thirdparty sourcing, information technology (IT) software
implementation and updates, and other relevant
programs across the organization.

Establishing an enterprise-wide
definition for AI/ML is necessary
to facilitate a consistentunderstanding, communicate
and prioritize AI/ML use cases,
and design risk management
frameworks.

Building the right governance model for AI/ML | 10

The way forward: four steps to establish governance and risk frameworks that streamline and scale AI/ML adoption

2

Enhance existing risk management and control
frameworks to address AI/ML-specific risks

Enhance individual risk assessment andcontrol frameworks
Existing risk and control frameworks — including
model risk management (MRM), data management(including privacy), compliance and operational risk
management (IT risk, information security, third
party, cyber) — may not explicitly address AI/ML risks
and thus need to be enhanced.
The MRM and data management frameworks are
key risk and control frameworks as they bring the
AI/ML technique, data, platform and use together.
For example, the existing MRM framework, which
evaluates conceptual soundness, outcome analysis
and change management across the model life cycle,
may not be adequate in capturing AI/ML risks due totheir inherent opacity, dynamic calibration and use oflarge volumes of data.
The MRM framework should be enhanced toaddress these considerations across AI/ML model
development, implementation, validation and use.
For example, if transparency is a key limitation for an
AI/ML model given the use case, certain
compensating controls, such as benchmarking,feature statistics, data point inspections and otherpreventive controls, may be considered.
The existing data management framework should
be enhanced to assess the scope of data sources(including third-party data), improve data quality
programs to profile inbound data, establish
entitlement permissions, embed data privacy
requirements and strengthen data monitoringprocesses. As part of AI/ML application development,
developers and validators must understand thesuitability of underlying data and associatedrisks from data sourcing, data filtration, feature

11 | Building the right governance model for AI/ML

engineering and data bias/representativeness.
Similarly, other control frameworks, including
compliance (especially for consumer applications) andoperational risks (third party, technology risks, etc.),
may need to be enhanced to address risks related to
conduct, fair lending, data privacy and underlying
technology infrastructure as AI/ML applications
automate or guide human decisioning.
In addition, as underlying risk and control frameworks
are being enhanced, enterprise-wide training programs
should be updated to train the relevant stakeholders
on key aspects of AI/ML, including applications,ecosystems, risks and controls.

Establish cross-functional governance
It is critical not only to enhance the individual
frameworks, but also holistically assess theirinterdependencies and coverage to manage aggregaterisks across the AI/ML application life cycle and avoid
gaps in coverage.
No one function or group will have the full competency
and understanding of AI/ML risks, as lines between
the risk stripes will blur due to the dynamic nature ofrisks. Given the interconnected nature of AI/ML risks,banks should establish cross-functional governancewith clear understanding of roles and responsibilities(including first-line accountability) and coverage acrossmultiple independent risk management functions (e.g.,model risk management, compliance, operational risk).

The way forward: four steps to establish governance and risk frameworks that streamline and scale AI/ML adoption

For illustrative purposes, consider a credit
underwriting model based on complex techniques(e.g., gradient boosting method) that uses bothtraditional data (e.g., credit information) andalternate data (e.g., social media activity). The
suitability and quality of alternative data may raisedata privacy, discrimination and bias concerns. In
addition, the opacity of the technique may further
introduce unintended bias. To manage the risks, MRM
and compliance functions will need to understandboth conceptual soundness and fair lending

implications during model development, validation,
implementation and use. The MRM function will bringtransparency to the AI/ML application and rely on thecompliance function for the regulatory expertise on fairlending and related customer disclosure considerations.
Risk and control frameworks should incorporate eightcontrol design principles to mitigate AI/ML risks asreliance on these applications and overall risk impact
increase. Control principles from governing electronic
trading algorithms can serve as a starting point for AI/ML(see figure 3).

Control design principles include:
1. Validation: assessing conceptual soundness and algorithms’ fitness for specific uses
2. Verification: testing during development, implementation and ongoing use to confirm thatalgorithm and control environments are functioning properly
3. Preventive controls: embedding controls and fail-safe mechanisms (e.g., kill switches)in the design of the algorithm to control inputs, processing and outcomes
4. Operational resiliency and stress testing: conducting overall assessments of AI/ML platforms
for resiliency from outages, adversarial attacks or other disruptions
5. Human control/override: enabling humans to take control of or override algorithm output
based on certain conditions or exceptions
6. Compliance with rules and regulations: embedding rules and regulatory requirements inalgorithm design and monitoring
7. Organizational code of conduct: verifying that algorithm usage is in line with the code of
conduct, including ethical standards for both internal and external stakeholders
8. Ecosystem monitoring: establishing key risk and control indicators across the AI/ML
ecosystem to monitor ongoing performance and manage issues

Building the right governance model for AI/ML | 12

The way forward: four steps to establish governance and risk frameworks that streamline and scale AI/ML adoption

Figure 3: Design principles for cross-functional governance and controls

Key inputs
AI/ML deﬁnition

AI/ML strategy

AI/ML risk assessment

Effective challenge

Cross-functional risk and control framework
Model
risk
management
Data
governance

Information
security
and cyber

Conduct/
compliance/
legal

AI/ML risk
management

Technology
risk/SDLC
Third-party
management

Business
process

Resiliency/
business
continuity

Control design principles

1

Validation

5

Human control/
override2

Veriﬁcation

6

Compliance withrules and regulations

3

Preventive
controls

7

Organizational
code of conduct

4

Operational resiliency
and stress testing

8

Ecosystem
monitoring

AI/ML capabilities
IT infrastructure(e.g., platform, cloud, libraries, API)

Ideation/POC

Business case

Initiation

Data management

Development

Implementation

AI/ML model life cycle

13 | Building the right governance model for AI/ML

Talent(e.g., data lake)

Use

ChangeRetirement

The way forward: four steps to establish governance and risk frameworks that streamline and scale AI/ML adoption

Develop risk-based application of controls to
promote innovation and speed to market
Risk and control requirements should enable
responsible innovation and increase speed tomarket. Given that AI/ML applications will beconsidered for a wide range of use cases, including
process automation and internal operational
efficiency, it is important to implement a riskbased approach to apply enhanced governanceand control requirements. Such an approach isbased on the idea that lower-risk applications do
not warrant the same level of rigor and intensity ofcontrols as high-risk applications. In the absence ofa risk-based approach, resources may be diverted
away from high return on investment (ROI) use
cases, potentially slowing down implementation anddiscouraging innovation.
One method is to perform an initial risk assessment,
which provides frontline units and independentrisk functions with transparency prior to AI/ML
application development. The initial risk assessment
can be based on a range of factors, including:• Financial, reputational, conduct and/or regulatorycompliance impacts• Level of reliance on the applications• Complexity of the technique used
• New sources of data (including third party) or
unstructured or high-dimensional data
• Use in new products and services• Level of AI/ML technique maturity anddevelopment experience• Vendor applications
For AI/ML applications considered to be high risk(e.g., customer-facing use cases), banks may
consider a process like that used for new productapproval (NPA). This will require frontline units
to perform an assessment of ROI, risk impacts,
limitations, compensating controls and capabilities
prior to application development. Independent risk
management functions would review and challenge
the business case and control capabilities as part of
the NPA process.
For low-risk AI/ML applications (e.g., internal
process automation), banks may allow independentrisk management functions to fast-track approvals,
provided certain conditions are met. Thoseconditions may include use of existing IT and othercontrol frameworks, baseline documentation, use of
approved infrastructure, preventive controls, testing
and monitoring.

Risk and control requirements
should enable responsible
innovation and increase speed
to market.

Building the right governance model for AI/ML | 14

The way forward: four steps to establish governance and risk frameworks that streamline and scale AI/ML adoption

3

Implement an operating model for
responsible AI/ML adoption

Successful AI/ML adoption entails having an
operating model that directs investments toward
those AI/ML applications with the highest ROI andchance of success, while factoring in risk and control
considerations. To this end, the operating model
must balance the need for frontline experimentation,
exploration and POC development with the needfor consistent standards for initial ideation, ROI
assessment, production and internal controls.
The right operating model increases the chances ofsuccessful adoption by helping achieve:• Alignment with business strategy• Prudent use of scarce resources• Compliance with relevant policies and regulations
The key elements of the operating model will vary
based on organizational size and complexity, as well as
the scale and maturity of AI/ML development.
These elements include the following:
Oversight committee and reporting: banks should
consider leveraging existing oversight committees(e.g., model risk committee), which include seniorleadership from independent risk management
functions and business lines, as well as observers
for internal audit, to oversee enhancements to theexisting risk and control frameworks and monitor
implementation of AI/ML capabilities and applications.
Committee oversight can also bring together diverse
points of view to challenge the AI/ML adoption
strategy for different aspects like fairness and conduct.

15 | Building the right governance model for AI/ML

Given that AI/ML techniques will be used acrossmultiple use cases, providing aggregated reporting
across the enterprise will help the board and senior
management to communicate effectively with internaland external stakeholders on the AI/ML adoption
strategy.
Centers of excellence (CoEs) for AI/ML strategy
and application development: developing a
CoE-based operating model for AI/ML is consistent
with the practice at large US banks of consolidating
model development units by domain to drive expertise,incubate talent, prioritize opportunities, identify
operational efficiencies and enhance governance.
The scope and mandate of CoEs vary, ranging
from a purely advisory role to leading AI/ML model
development for new applications. To the extent that
AI/ML expertise is limited, banks may also consider
using existing innovation teams, establishing
AI/ML CoEs for new applications or designating
AI/ML specialists in existing model development units
to optimize adoption strategy.
AI/ML CoEs also help in disseminating leading practices
and lessons learned to help optimize the quality of
AI/ML applications, which, in turn, improves theapproval, ROI and success rate of adoption for
applications.

The way forward: four steps to establish governance and risk frameworks that streamline and scale AI/ML adoption

4

Invest in capabilities that support AI/ML
adoption and risk management

Rapid growth and adoption of AI/ML applications
requires a long-term view of business objectives
to prioritize investment in the overall ecosystem
supporting AI/ML. As part of their AI/ML adoption
strategy, banks should develop two- to three-year
projections on the products, services and processes
that will use AI/ML applications and how investment
in AI/ML capabilities (data, modeling infrastructure,
talent) will be prioritized to meet business needs.
Data management: banks continue to invest in
improving overall data quality. Some banks aredesignating authorized data and feature repositories
supported by a centralized team of data scientists.
This allows AI/ML application developers to see
available data across the enterprise and access robust
data sets along with business insights for agile AI/ML
application development. Banks should leverage andexpand investments in next-generation data strategy
and architecture (e.g., data lakes, cloud) by enhancing
end-to-end data management standards for AI/ML
application development and use.
AI/ML modeling infrastructure: some banks arebuilding internally or working with third parties todevelop next-generation data management processes
and architecture that incorporate new AI/ML modelingplatforms and enhancements to existing modelingplatforms. The goal is to make data, compute and AI/ML
application approvals seamless, scalable and accessible
across the enterprise in an easy-to-use, integrated andcontrolled manner. This integrated infrastructure will
enable agile AI/ML application development, scalable
implementation and validation as capabilities from data
and modeling (e.g., pre-vetted vendor and open source
solutions) are more seamlessly supported.
Talent: AI/ML adoption will be dependent on theavailability of diverse teams, including productmanagers, data scientists, data engineers, application
developers, risk managers and internal auditorswith knowledge of AI/ML applications, business
requirements, risks and related controls.
The AI/ML talent shortage is a key challenge acrossindustries, including financial services, and the talent
shortage will become even more acute as thesetechniques are used broadly. Such talent shortage
not only affects the development and use of AI/ML
applications, but also influences oversight, control andaudit of these applications.
Because talent can be a competitive advantage,banks will need to develop an enterprise-wide talentmanagement approach that aligns with the roles needed
to support AI/ML throughout the life cycle. Programs to
attract, develop and upskill talent across the frontline
units, independent risk management functions andinternal audit will be important in light of the shortageof AI/ML expertise in the industry.

Building the right governance model for AI/ML | 16

Conclusion | Further reading

Conclusion
To scale the use of AI/ML
techniques, banks need to alignbusiness strategy, risk appetite
and internal controls to inform
investment in a resilient AI/ML
ecosystem. Banks need to recognize
the interaction of dynamic andinterconnected risks, enhancecontrols and governance to foster
accountability, and build capabilities
to establish stakeholder trustand confidence. A holistic view ofgovernance and capabilities will
accelerate adoption and enablebanks to further realize the benefitsof AI/ML techniques.

17 | Building the right governance model for AI/ML

Further reading
What is intelligence
without trust?
Five key areas that can help
business leaders build trust, evenas AI continues to transformbusinesses

How do you teach AI thevalue of trust?
How embedding trust from thestart can help companies reap
AI’s rewards

Contacts

Ernst & Young LLP
contacts
Rushabh Mehta
Partner, Financial Services Risk Management
rushabh.mehta@hk.ey.com+852 2629 3263
David Scott
Partner, Financial Services Risk Management
david.scott@hk.ey.com+852 2629 3070
Meena Datwani
Senior Advisor Regulatory Affairs
meena.datwani@hk.ey.com+852 3189 4426
Eugene Goyne
Associate Partner, Financial Services Regulatory Leader
eugene.goyne@hk.ey.com+852 9666 3434
Jeremy Pizzala
Partner, Financial Services Advisoryjeremy.pizzala@hk.ey.com+852 2846 9085
Chris Barford
Director, Financial Services Advisory
chris.barford@hk.ey.com+852 9666 6347

Building the right governance model for AI/ML | 18

EY | Assurance | Tax | Transactions | Advisory
About EY
EY is a global leader in assurance, tax, transaction and advisory services.
The insights and quality services we deliver help build trust and confidence
in the capital markets and in economies the world over. We develop
outstanding leaders who team to deliver on our promises to all of our
stakeholders. In so doing, we play a critical role in building a better working
world for our people, for our clients and for our communities.
EY refers to the global organization, and may refer to one or more, of themember firms of Ernst & Young Global Limited, each of which is a separate
legal entity. Ernst & Young Global Limited, a UK company limited byguarantee, does not provide services to clients. Information about how EY
collects and uses personal data and a description of the rights individuals
have under data protection legislation are available via ey.com/privacy. For
more information about our organization, please visit ey.com.
Ernst & Young LLP is a client-serving member firm ofErnst & Young Global Limited operating in the US.
EY is a leader in serving the global financial services marketplace
Nearly 51,000 EY financial services professionals around the worldprovide integrated assurance, tax, transaction and advisory services to ourasset management, banking, capital markets and insurance clients. In theAmericas, EY is the only public accounting organization with a separatebusiness unit dedicated to the financial services marketplace. Createdin 2000, the Americas Financial Services Organization today includes
more than 11,000 professionals at member firms in over 50 locations
throughout the US, the Caribbean and Latin America.
EY professionals in our financial services practices worldwide alignwith key global industry groups, including EY’s Global Wealth & AssetManagement Center, Global Banking & Capital Markets Center, Global
Insurance Center and Global Private Equity Center, which act as hubs
for sharing industry-focused knowledge on current and emerging
trends and regulations in order to help our clients address key issues.
Our practitioners span many disciplines and provide a well-rounded
understanding of business issues and challenges, as well as integrated
services to our clients.
With a global presence and industry-focused advice, EY’s financial services
professionals provide high-quality assurance, tax, transaction and advisory
services, including operations, process improvement, risk and technology,
to financial services companies worldwide.
© 2020 Ernst & Young LLP.
All Rights Reserved.
EYG no. 000048-20Gbl
1912-3340504 BDFSOED NoneThis material has been prepared for general informational purposes only and is not intended to berelied upon as accounting, tax or other professional advice. Please refer to your advisors for
specific advice.

ey.com